Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

55
votes
10answers
5k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
20
votes
5answers
5k views

How can I tell if my website visitors are using LastPass or other password managers?

I want to make sure visitors to my website have the best experience possible so I want them to be able to use LastPass and other Password Managers. Is there any way of identifying whether or not my ...
17
votes
5answers
585 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
16
votes
6answers
5k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
15
votes
2answers
515 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
14
votes
2answers
46k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
14
votes
2answers
5k views

How to find domain registrar and DNS hosting with good DNSSEC support?

Simplified problem I want to buy a domain and make a website that is fully secured with DNSSEC. I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
13
votes
7answers
2k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a "trustmark" image if the site passes their tests. This allegedly increases the level of trust a ...
13
votes
4answers
249 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
12
votes
1answer
626 views

Could somebody hijack my Google Analytics for a site?

I track many websites in Google Analytics. Recently I accidentally added tracking code for site A to site B, which I noticed a couple of weeks later. By then, one website had two weeks of no visitors, ...
11
votes
4answers
2k views

HTTPS connection is “not safe” due to images

I am currently working on a website and I have successfully installed my SSL certificate. The GeoTrust SSL/TLS checker confirmed that the certificate chain (including CA) is properly installed. ...
11
votes
3answers
150 views

Is it sufficient to secure a order status page just by a random URL?

After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him. We'd like to inform our customer about received payments, packet ...
10
votes
8answers
946 views

How to find out the strength of the Wordpress (already stored) password?

I am responsible for security of lots of shared hosting server. Most of them are having WordPress websites. Each server is having at least 500 WordPress websites. In my expereince, the issue with ...
10
votes
2answers
613 views

Forum Spam Question. Why are Chinese hackers posting tiny images on my forum

My forum is getting attacked by spammers with Chinese IP's. Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
10
votes
3answers
4k views

what is wwws.site.com

I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example https://wwws.site.com/login
10
votes
4answers
718 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
10
votes
1answer
531 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
10
votes
5answers
189 views

Is PCI compliance scrutinised?

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
10
votes
1answer
425 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
10
votes
1answer
680 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
9
votes
2answers
645 views

Does the 'Server' header serve any purpose?

For example, when I dump the response header for my server I get: Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g Is this used for anything? Is ...
9
votes
3answers
1k views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
8
votes
8answers
491 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
8
votes
3answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
7
votes
5answers
663 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
7
votes
3answers
1k views

Important fields in HTTP header from security perspective

What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
7
votes
5answers
225 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
7
votes
1answer
163 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
7
votes
3answers
125 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
7
votes
4answers
246 views

Webhosting company able to unhash passwords?

Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
7
votes
3answers
215 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
7
votes
2answers
4k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
7
votes
1answer
79 views

Someone/something accessed a link in an email, but it was not who the email was sent to

Could anyone solve this mystery? We have an web application that is only available to invited users. Our admin create accounts for users, and then the application sends an activation email to that ...
6
votes
5answers
585 views

Are indexed Wordpress admin pages a security threat?

Because it was blocking Googlebot from accessing important files, I recently updated our /robots.txt file and removed most of it, including wp-admin. Now, the people on charge of hosting and SEO ...
6
votes
3answers
116 views

Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?

My host gave me a subdomain of their domain that has HTTPS: https://mysite.example.com My own domain name has no SSL installed, so the only way I can take advantage of encryption is by using the ...
6
votes
3answers
401 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
4answers
3k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...
6
votes
2answers
466 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have ...
6
votes
2answers
2k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
6
votes
6answers
6k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
3answers
325 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
6
votes
3answers
164 views

Why don't we see websites hashing passwords before sending them? [closed]

(Note about the question title: by "we" I mean myself) Everytime I log on to any website, I have this thought that website asking me for my password and sending it back to the server is just basic ...
6
votes
1answer
943 views

Security: Hide mysql connection details file

Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
6
votes
1answer
417 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
6
votes
2answers
1k views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
6
votes
2answers
209 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
6
votes
3answers
240 views

Is website security accreditation worth having?

My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
6
votes
1answer
111 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
6
votes
3answers
176 views

How would you establish user credibility for your web app?

One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
6
votes
2answers
124 views

Using WordPress for large collaborative site

I work for a government agency, and we're thinking about creating a new, fairly large site using WordPress as the platform. It would involve allowing quite a few people around the state access to the ...